PLAN-003 — Rust-native Engineering Assurance
Contents of the PLAN-003 Rust-native migration bundle.
Open source Repository Open in the app JSON README (API)
About
# PLAN-003 — Rust-native Engineering Assurance
## Contents
* [PLAN-003: Rust-native Engineering Assurance](./plan.md) - Migration overview, dependency graph, tests, tracks, and gates.
* [TASK-012: Establish the Rust package foundation](./tasks/TASK-012-rust-package-foundation.md) - Existing package and exact-toolchain foundation.
* [TASK-013: Port compatibility classification](./tasks/TASK-013-compatibility-classification.md) - Existing read-only compatibility slice.
* [TASK-014: Port evidence availability and identity](./tasks/TASK-014-evidence-availability-identity.md) - Current evidence-classification slice and review remediation.
* [TASK-015: Implement the versioned CLI boundary](./tasks/TASK-015-versioned-cli-boundary.md) - Protocol, limits, process, and refusal behavior.
* [TASK-016: Port semantic validation, projections, and fixtures](./tasks/TASK-016-semantic-projections-fixtures.md) - Remaining pure shared semantics.
* [TASK-017: Implement the assurance-contract registry](./
Details
- Kind
- OKF bundles
- Topic
- Developer tools
- Publisher
- agent-ix
- Origin
- okf_github
- Category
- dados
- Version
- 0.1
- Last push
- 2026-09-10T03:32:37Z
- Repository state
- ativo
- Language
- Python
- License
- AGPL-3.0
- Added
- 2026-09-09 05:06:57
- Updated
- 2026-09-09 05:06:57
- Origin id
agent-ix/engineering-assurance:plan/PLAN-003-rust-native-engineering-assurance/index.md
README
# Engineering Assurance
Engineering Assurance is an opt-in Quire module for authoring explicit
decision boundaries, measurement plans, component contracts, architecture
descriptions, and assurance arguments.
The module is configuration-only. It does not calculate a trust or compliance
score, embed external rules, or make a release decision. Decision owners remain
responsible for claims, exceptions, evidence sufficiency, and terminal workflow
choices.
## Local use
```bash
quire validate --scope . 'spec/**/*.md'
ix-flow run change-assurance --path engineering_assurance/skills/assurance-onboarding
```
The canonical onboarding skill is
`engineering_assurance/skills/assurance-onboarding/SKILL.md`. Claude Code,
Codex, opencode, and GitHub Copilot discovery surfaces all resolve that same
tree.
The former pilot path remains compatible for this release:
```bash
ix-flow run change-assurance --path pilots/assurance-workflows
```
The scoped Quire installation must include this module and the ecosystem's
shared relation registry.
The repository is public. Registry packages remain private and unpublished;
changing their release posture requires fresh authorization of both content
rights and distribution controls.
## Native package
The repository owns one unpublished Cargo package with the
`engineering_assurance` library and `engineering-assurance` CLI. The exact
Rust 1.98.1 toolchain is selected by `rust-toolchain.toml`.
The additive boundary exposes package identity plus a pure compatibility
classifier. Callers observe component versions outside the library and submit
one strict request on stdin:
```bash
printf '%s\n' '{"protocol":"engineering-assurance.compatibility-request/v1","observed":[]}' \
| cargo run --quiet -- compatibility
```
Request, result, and error schemas live under
`engineering_assurance/schemas/`. A compatible result exits 0, a valid but
withheld result exits 1, and malformed or unsupported input exits 2. This slice
does not yet replace the repository's legacy observation and qualification
paths, and it does not claim that all Python, JavaScript, or MJS paths have been
removed.
```bash
make rust-foundation-gate
```
## Development
```bash
make lint
make test
make package-audit
make rust-foundation-gate
make rust-deps
make integration-gate
```
`integration-gate` is reproducible from tracked repository content. It runs
rights, Ruff, pytest, manifest, package, Quire document, and traceability checks.
Real-agent reports are operational evidence and remain ignored under
`evals/reports/`; do not commit workstation paths, session output, or transcripts.
After producing and retaining a four-host aggregate in that directory, run the
complete release gate through one stable target:
```bash
make release-gate \
EVAL_AGGREGATE_REPORT=evals/reports/aggregate-<revision>.json
```
The release gate additionally revalidates every supplied retained report and
transcript, the 28/28 complete-only aggregate, current governing files, and
current Quire, Quoin, ix-flow, and cli-evals executable identities. It fails
closed when `EVAL_AGGREGATE_REPORT` is omitted.
Read [CONTENT_RIGHTS.md](CONTENT_RIGHTS.md) before adding content.